shugoi 0.2.0 → 0.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: bb399ab3d75413beea51021d09dba771d642cdeae0b6ebd08dee8cb9f43ebec9
-  data.tar.gz: 39a2adb0773270d1bf1712a2626b8875c95758dee55eaeb7d179353a32518d50
+  metadata.gz: 57dac16265f7ee95d5a4b898026d14fb318c695681eef25607ba427fbc260b59
+  data.tar.gz: ec35d03b156df7fa25750d794e338978c47dc8288bded4aec4542a732eb70c58
 SHA512:
-  metadata.gz: 6c9cd4918e288e14437d0c5c5bc5b7068fb63b84a9d4a56989525d45dbbcce8e10d1a9fd08d4d013d6ed0ff670d12acd679133e3b4b43a9b04147bcb3f53e616
-  data.tar.gz: de83aeafd3d23b27cc4d60a5ff23325c81940c2fe8102a8d6c54e9f688c683876940bb0fbef001ddbc63b52c1c27a5af4ba3672df91bbdc6d97e767d5c6a8f7d
+  metadata.gz: 995c4835ad283fb5b7e614ab897c896d7dd29a0bb1ebbdb7a3bb7d3374a51921419e0f1160f59482b5e1e108f606a32a6d7b6f9adfded0a23b9531e6c4d3f1cd
+  data.tar.gz: 2af87cfffe903de0dffc18ba56887347e18af11c31d49fa1e3973b35d56e2c8d345b9d67b47592554798e7aa7afe72084d46abecefa70232ae43910b06300c75

data/lib/shugoi/bot_verifier.rb

@@ -0,0 +1,68 @@
+# frozen_string_literal: true
+
+require "resolv"
+
+module Shugoi
+  # Vérifie par DNS inverse + forward que les bots whitelistés viennent bien de leurs
+  # plages officielles — parité avec verify-bot.ts (module Node). Résultat mis en cache.
+  class BotVerifier
+    BOT_DOMAINS = [
+      { pattern: /Googlebot|Google-InspectionTool|Storebot-Google/i, suffixes: [".googlebot.com", ".google.com"] },
+      { pattern: /Bingbot|adidxbot|BingPreview/i, suffixes: [".search.msn.com"] },
+      { pattern: /Slurp/i, suffixes: [".crawl.yahoo.net"] },
+      { pattern: /DuckDuckBot/i, suffixes: [".duckduckgo.com"] },
+      { pattern: /YandexBot/i, suffixes: [".yandex.ru", ".yandex.net", ".yandex.com"] },
+      { pattern: /Applebot/i, suffixes: [".applebot.apple.com"] }
+    ].freeze
+
+    VERIFY_TTL_MS = 3_600_000
+    MAX_ENTRIES = 5000
+
+    def initialize
+      @cache = {}
+      @mutex = Mutex.new
+    end
+
+    # @param ua [String] User-Agent
+    # @param ip [String] IP du client
+    # @return [true, false, nil] true/false si UA reconnu, nil sinon
+    def verify(ua, ip)
+      entry = BOT_DOMAINS.find { |b| b[:pattern].match?(ua) }
+      return nil unless entry
+      return false if ip.to_s.empty? || ip == "unknown"
+
+      key = "#{ip}|#{entry[:suffixes][0]}"
+      @mutex.synchronize do
+        hit = @cache[key]
+        return hit[:ok] if hit && Utils.now_ms - hit[:at] < VERIFY_TTL_MS
+      end
+
+      ok = reverse_forward_match?(ip, entry[:suffixes])
+
+      @mutex.synchronize do
+        prune
+        @cache[key] = { ok: ok, at: Utils.now_ms }
+      end
+      ok
+    end
+
+    private
+
+    # PTR de l'IP → nom se terminant par un suffixe attendu, puis forward vérifié.
+    def reverse_forward_match?(ip, suffixes)
+      names = Resolv.getnames(ip)
+      name = names.find { |n| suffixes.any? { |s| n.downcase.end_with?(s) } }
+      return false unless name
+      addresses = Resolv.getaddresses(name)
+      addresses.include?(ip)
+    rescue Resolv::ResolvError, StandardError
+      false
+    end
+
+    def prune
+      if @cache.size >= MAX_ENTRIES
+        @cache.delete(@cache.keys.min_by { |k| @cache[k][:at] })
+      end
+    end
+  end
+end

data/lib/shugoi/config.rb

@@ -23,8 +23,9 @@ module Shugoi
       split_render: true,
       multi_process: false,
       verify_bots: true,
-      pow_difficulty: 10,
-      pow_ttl_ms: 120_000
+      # Parité module Node : difficulté PoW 14 par défaut (configurable), TTL 60 s.
+      pow_difficulty: 14,
+      pow_ttl_ms: 60_000
     }.freeze
 
     attr_reader :options

data/lib/shugoi/core.rb

@@ -1,12 +1,20 @@
 # frozen_string_literal: true
 
 module Shugoi
-  # Évaluation d'une requête : pre-flight PoW challenge, /__sg_challenge, blocage headless.
+  # Évaluation d'une requête : pre-flight PoW challenge, /__sg_challenge, blocage headless,
+  # cookie __sg_ok, preuve single-use, rate-limit du challenge, protection des assets.
   # Parité avec core.ts (module Node).
   class Core
     # Résultat de blocage renvoyé au middleware.
     Decision = Struct.new(:status, :content_type, :body, :headers, keyword_init: true)
 
+    POW_OK_TTL_MS = 30 * 24 * 3600 * 1000
+    POW_TTL_MS = 60_000
+    CHALLENGE_LIMIT = 60
+    CHALLENGE_WINDOW_MS = 60_000
+    CHALLENGE_MAX_BLOCK_MS = 15 * 60 * 1000
+    VALIDATION_WARN_INTERVAL = 3_600_000
+
     def initialize(config, pow, api_client)
       @config = config
       @pow = pow
@@ -14,18 +22,32 @@ module Shugoi
       @validation_valid = false
       @validation_failed = false
       @validation_warned_at = 0
+      @used_proofs = {}
+      @challenge_limits = {}
+      @mutex = Mutex.new
+      @bot_verifier = config.verify_bots ? BotVerifier.new : nil
     end
 
-    # @param ctx [Hash] { path:, ua:, ip:, host:, accept_language:, sec_fetch_dest:, sec_fetch_mode:, sg_proof:, forwarded_prefix: }
+    # @param ctx [Hash] { path:, ua:, ip:, host:, accept_language:, sec_fetch_dest:, sec_fetch_mode:, sg_proof:, sg_ok:, sg_authorized:, forwarded_prefix: }
     # @return [Decision, nil] nil = laisser passer
     def evaluate(ctx)
       path = ctx[:path].to_s
+
+      # Protection des assets à contenu (/assets/*.js, *.css) — parité core.ts. Le bundle
+      # SPA est téléchargeable publiquement sans ce verrou : on exige le cookie
+      # __sg_authorized posé par handleRender après un render réussi (grant valide).
+      # NB : vérifié AVANT l'allowlist (les assets sont allowlistés pour le split-render).
+      if path.match?(%r{/assets/[^?#]+\.(js|css)(\?|$)})
+        auth_ok = !ctx[:sg_authorized].to_s.empty? && @pow.sg_authorized_valid?(ctx[:sg_authorized])
+        return Decision.new(status: 403, content_type: "text/plain", body: BLOCK_PAGE, headers: {}) unless auth_ok
+      end
+
+      ensure_validated
+      warn_if_validation_failed
       return nil if @config.is_allowlisted?(path)
 
       # Route du challenge JS (le navigateur arrive ici après le 307).
-      if path == "/__sg_challenge"
-        return challenge_page
-      end
+      return challenge_page(ctx) if path == "/__sg_challenge"
 
       # Pre-flight PoW challenge (anti-curl/view-source).
       return nil if path.include?("/__shugoi/") || path.start_with?("/api/")
@@ -33,13 +55,23 @@ module Shugoi
 
       if ua.match?(/Mozilla/i) && !@config.signing_secret.to_s.empty?
         proof = ctx[:sg_proof].to_s
-        unless @pow.valid?(proof)
-          return pow_challenge_307(ctx)
+        valid_proof = !proof.empty? && @pow.valid?(proof)
+        # Re-audit (résidu #3) : un cookie __sg_ok valide (HMAC serveur, 30 j) saute le
+        # pre-flight PoW. Posé APRÈS une première résolution réussie (middleware).
+        valid_cookie = !ctx[:sg_ok].to_s.empty? && @pow.sg_ok_valid?(ctx[:sg_ok])
+        # Round 16 (R2) : la preuve est SINGLE-USE (par IP) — un rejeu → 307.
+        proof_fresh = valid_proof ? consume_proof(proof, ctx[:ip].to_s) : false
+        unless valid_cookie || proof_fresh
+          return pow_challenge_307(ctx) if allow_challenge?(ctx[:ip].to_s)
+
+          loc = Locales.resolve_locale(@config.locale, ctx[:accept_language])
+          msgs = Locales.messages(loc)
+          return Decision.new(status: 429, content_type: "text/html", body: shield_page(msgs[:rate_limit_title], msgs[:rate_limit_body], msgs[:rate_limit_badge], ctx[:host].to_s, 60, loc), headers: {})
         end
       end
 
-      # Blocage headless (UA).
-      if ua.match?(/Mozilla/i) == false && @config.is_headless?(ua)
+      # Blocage headless (UA). Actif par défaut, y compris sans configuration chargée.
+      if !ua.empty? && !is_trusted_bot?(ua, ctx[:ip].to_s) && @config.is_headless?(ua)
         @api_client.post_event(@config.site_key, "headless", "")
         return Decision.new(status: @config.block_status, content_type: "text/plain", body: BLOCK_PAGE, headers: {})
       end
@@ -47,14 +79,33 @@ module Shugoi
       nil
     end
 
+    # Vrai si un bot whitelisté (UA) est authentifié par DNS inverse (parité isTrustedBot).
+    def is_trusted_bot?(ua, ip)
+      return false unless @config.is_whitelisted_bot?(ua)
+      return true unless @bot_verifier
+
+      verified = @bot_verifier.verify(ua, ip)
+      verified.nil? ? true : verified
+    end
+
     # Page challenge (tableau en commentaire + JS PoW inline).
-    def challenge_page
+    def challenge_page(ctx)
+      loc = Locales.resolve_locale(@config.locale, ctx[:accept_language])
+      if !allow_challenge?(ctx[:ip].to_s)
+        msgs = Locales.messages(loc)
+        return Decision.new(status: 429, content_type: "text/html", body: shield_page(msgs[:rate_limit_title], msgs[:rate_limit_body], msgs[:rate_limit_badge], ctx[:host].to_s, 60, loc), headers: {})
+      end
       js = <<~JS
         (function(){
         var P=new URLSearchParams(location.search);
-        var salt=P.get('salt')||'', ts=P.get('ts')||'', diff=parseInt(P.get('diff')||'10',10), path=P.get('path')||'/';
+        var salt=P.get('salt')||'', ts=P.get('ts')||'', diff=parseInt(P.get('diff')||'#{@config.pow_difficulty}',10), path=P.get('path')||'/';
+        // Open redirect (audit #5) : un //evil.com (protocole-relatif) ou un backslash
+        // détourneraient le location.replace ci-dessous vers un domaine externe.
+        if(path.charAt(0)!=='/'||path.charAt(1)==='/'||path.indexOf('\\\\')>=0)path='/';
         var enc=new TextEncoder();
-        function bits(d){var l=0;for(var i=0;i<d.length;i++){var b=parseInt(d[i],16);if(b===0){l+=4;continue}var s=b.toString(2),z=0;while(z<s.length&&s[z]==='0')z++;l+=z;break}return l}
+        // Audit 2026-08-03 : comptage de bits CORRIGÉ (zéros internes du premier nibble
+        // non-nul comptés) — DOIT rester synchrone avec Pow#valid? + guard + whitelist.
+        function bits(d){var l=0;for(var i=0;i<d.length;i++){var b=parseInt(d[i],16);if(b===0){l+=4;continue}l+=(b&8)?0:(b&4)?1:(b&2)?2:3;break}return l}
         var n=0;
         function step(){
           crypto.subtle.digest('SHA-256',enc.encode(salt+':'+n.toString(16))).then(function(buf){
@@ -72,6 +123,24 @@ module Shugoi
 
     private
 
+    # Page de blocage néobrutaliste (parité shieldPage de core.ts).
+    def shield_page(title, msg, badge, host, remain_secs, locale)
+      msgs = Locales.messages(locale)
+      prefix = msg.to_s.sub(/Il reste \d+ seconde?s?.*$/, "").sub(/Retry in \d+s?.*$/, "").strip
+      countdown_script = if remain_secs.positive?
+                           '<script>var s=' + remain_secs.to_s + ';var i=setInterval(function(){s--;var e=document.getElementById("cd");if(e){if(s<=0){e.innerHTML="0s";clearInterval(i);setTimeout(function(){location.reload()},500)}else{e.innerHTML=s+"s"}}},1000)</script>'
+                         else
+                           ""
+                         end
+      desc = remain_secs.positive? ? "#{prefix} #{msgs[:retry_in_seconds].call(remain_secs)}" : msg.to_s
+      html_title = Utils.escape_html(title.to_s.empty? ? msgs[:blocked_title] : title)
+      html_badge = Utils.escape_html(badge.to_s.empty? ? msgs[:blocked_badge] : badge)
+      html_host = Utils.escape_html((host.to_s.empty? ? "shugoi.com" : host).slice(0, 120))
+      html_desc = Utils.escape_html(desc)
+      html_lang = locale == "fr" ? "fr" : "en"
+      '<!DOCTYPE html><html lang="' + html_lang + '"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><style>@font-face{font-family:\'Alex Brush\';src:url(https://shugoi.com/alex-brush.woff2?v=2) format(\'woff2\');font-display:swap}*,*::before,*::after{box-sizing:border-box;margin:0;padding:0}html,body{height:100%;background:#fcf9f5}body{font-family:system-ui,-apple-system,\'Segoe UI\',Roboto,sans-serif;display:flex;align-items:center;justify-content:center;padding:1.2rem}#c{max-width:460px;width:100%;background:#fff;border:4px solid #000;border-radius:28px 6px 32px 10px;box-shadow:12px 12px 0 #000;padding:3rem 2.4rem 2.8rem;text-align:center}#c .l{width:80px;height:80px;pointer-events:none;transform:rotate(-2.5deg);margin:0 auto .6rem;display:block}#c .b{display:block;margin:0 auto .2rem;pointer-events:none;max-width:100%;height:auto}#c .bdg{display:inline-block;border:2px solid #000;border-radius:10px 2px 14px 4px;padding:.3rem .9rem;font-size:.6rem;font-weight:700;text-transform:uppercase;letter-spacing:.1em;color:#E87090;margin-bottom:1.4rem}#c h2{font-family:\'Alex Brush\',Georgia,"Times New Roman",serif;font-size:2.2rem;color:#E87090;font-weight:400;margin:0 auto .6rem}#c p.desc{font-size:.9rem;color:#555;line-height:1.8;max-width:380px;margin:0 auto}#c p.ft{font-size:.55rem;color:#E87090;margin-top:1.8rem}</style></head><body><div id=c><img src=https://shugoi.com/favicon.png alt class=l><img src=https://shugoi.com/brand.png alt class=b><div class=bdg>' + html_badge + '</div><h2>' + html_title + '</h2><p class=desc>' + html_desc + '</p><p class=ft>' + html_host + ' \u00b7 Shugoi</p></div>' + countdown_script + '</body></html>'
+    end
+
     # 307 vers le challenge : body = tableau ASCII seul (curl le voit tel quel).
     def pow_challenge_307(ctx)
       ts = Utils.now_sec
@@ -79,10 +148,84 @@ module Shugoi
       prefix = ctx[:forwarded_prefix].to_s
       prefix = "" if prefix == "/"
       prefix = prefix.sub(%r{/\z}, "") unless prefix.empty?
-      path = ctx[:path].to_s
-      path = "/#{path}" unless path.start_with?("/")
+      path = safe_challenge_path(ctx[:path].to_s)
       chal_url = "#{prefix}/__sg_challenge?ts=#{ts}&salt=#{salt}&diff=#{@config.pow_difficulty}&path=#{URI.encode_www_form_component(prefix + path)}"
       Decision.new(status: 307, content_type: "text/plain", body: BLOCK_PAGE, headers: { "location" => chal_url })
     end
+
+    # Sanitisation open redirect (audit #5) : n'accepte qu'un chemin relatif commençant par
+    # UN SEUL '/', sans backslash ni caractères de contrôle.
+    def safe_challenge_path(p)
+      return "/" if p.to_s.empty?
+      return "/" unless p.start_with?("/")
+      return "/" if p.start_with?("//") || p.include?("\\")
+      return "/" if p.each_codepoint.any? { |c| c < 0x20 || c == 0x7f }
+
+      p
+    end
+
+    # Anti-scraping : borne par IP l'émission de challenges (quota + backoff exponentiel).
+    def allow_challenge?(ip)
+      return true if ip.to_s.empty? || ip == "unknown"
+
+      now = Utils.now_ms
+      @mutex.synchronize do
+        e = @challenge_limits[ip]
+        if e.nil? || now - e[:window_start] >= CHALLENGE_WINDOW_MS
+          @challenge_limits[ip] = { count: 1, window_start: now, blocked_until: 0 }
+          return true
+        end
+        e[:count] += 1
+        return false if e[:blocked_until] > now
+        if e[:count] > CHALLENGE_LIMIT
+          backoff = [60_000 * (2**[e[:count] - CHALLENGE_LIMIT, 10].min), CHALLENGE_MAX_BLOCK_MS].min
+          e[:blocked_until] = now + backoff
+          e[:count] = 0
+          return false
+        end
+        true
+      end
+    end
+
+    # Preuve PoW single-use (par IP) — entrées purgées après POW_TTL_MS.
+    def consume_proof(proof, ip)
+      key = "#{ip}:#{proof}"
+      @mutex.synchronize do
+        return false if @used_proofs.key?(key)
+        @used_proofs[key] = Utils.now_ms
+        now = Utils.now_ms
+        @used_proofs.delete_if { |_k, t| now - t > POW_TTL_MS }
+        true
+      end
+    end
+
+    # Validation de la clé (lazy) + avertissement périodique si elle échoue.
+    def ensure_validated
+      return unless @config.secret
+      return if @validation_valid || @validation_failed
+
+      result = @api_client.validate_key(@config.site_key, @config.secret)
+      if result["valid"] == true
+        @validation_valid = true
+      else
+        @validation_failed = true
+      end
+    rescue StandardError
+      @validation_failed = true
+    end
+
+    def warn_if_validation_failed
+      return unless @config.secret
+      return unless @validation_failed
+      return if Utils.now_ms - @validation_warned_at < VALIDATION_WARN_INTERVAL
+
+      @validation_warned_at = Utils.now_ms
+      warn(
+        "[shugoi] La validation de la clé a échoué pour le siteKey #{@config.site_key}.\n" \
+        "[shugoi] La protection reste active, mais cette installation n'est pas authentifiée.\n" \
+        "[shugoi] Vérifiez `site_key` et `secret` : https://shugoi.com/docs#validation"
+      )
+      @api_client.post_event(@config.site_key, "validation_failed", "")
+    end
   end
 end

data/lib/shugoi/csp.rb

@@ -0,0 +1,79 @@
+# frozen_string_literal: true
+
+require "uri"
+
+module Shugoi
+  # Construction + fusion de la Content-Security-Policy — parité avec csp.ts (module Node).
+  # Le module npm pose la CSP fusionnée sur chaque réponse (y compris les pages passées) :
+  # la base inclut l'origine de l'API (pour le guard client), les directives additionnelles
+  # et, en split-render, `unsafe-eval` (nécessaire au bootcode eval([...])).
+  class Csp
+    SHUGOI_ORIGIN = "https://shugoi.com".freeze
+
+    # Retourne l'origine (schéma://host[:port]) d'une base URL, nil sinon.
+    def self.origin_of(base_url)
+      return nil if base_url.to_s.empty?
+      u = URI.parse(base_url)
+      return nil unless %w[http https].include?(u.scheme)
+      origin = "#{u.scheme}://#{u.host}"
+      origin += ":#{u.port}" if u.port && u.port != u.default_port
+      origin
+    rescue URI::InvalidURIError
+      nil
+    end
+
+    # @param site_key [String] siteKey (parité d'API avec le module Node, inutilisé dans la construction)
+    # @param api_origin [String, nil] origine de l'API Shugoi à autoriser (connect-src/script-src…)
+    # @param extra_directives [Hash<String, Array<String>>] directives additionnelles fusionnées
+    # @param split_render [Boolean] false → retire 'unsafe-eval' de script-src
+    # @return [String] header CSP
+    def self.build(site_key:, api_origin: nil, extra_directives: {}, split_render: true)
+      api = [SHUGOI_ORIGIN, api_origin].compact.uniq
+      merged = {
+        "default-src" => ["'self'"],
+        "script-src" => ["'self'", "'unsafe-inline'", "'unsafe-eval'", *api],
+        "connect-src" => ["'self'", *api],
+        "style-src" => ["'self'", "'unsafe-inline'", *api],
+        "font-src" => ["'self'", *api, "data:"],
+        "img-src" => ["'self'", *api, "data:", "blob:"],
+        "frame-ancestors" => ["'self'"],
+        "object-src" => ["'none'"],
+        "base-uri" => ["'self'"],
+        "form-action" => ["'self'"]
+      }
+      extra_directives.each do |key, values|
+        merged[key] = ((merged[key] || []) + Array(values)).uniq
+      end
+      if split_render == false
+        merged["script-src"] = (merged["script-src"] || []).reject { |v| v == "'unsafe-eval'" }
+      end
+      merged.map { |k, v| "#{k} #{v.join(' ')}" }.join("; ")
+    end
+
+    # Fusionne une CSP existante (posée par l'app client) avec celle du module.
+    # Spec CSP : le mot-clé 'none' doit être SEUL dans une directive — sinon il est ignoré
+    # par le navigateur. Lors d'un merge, on garde uniquement 'none' (le plus restrictif).
+    def self.merge(existing, added)
+      return added if existing.to_s.empty?
+      base = parse(existing)
+      parse(added).each do |k, set|
+        base[k] = (base[k] || Set.new) | set
+      end
+      base.each do |k, set|
+        base[k] = Set.new(["'none'"]) if set.include?("'none'") && set.size > 1
+      end
+      base.map { |k, v| "#{k} #{v.to_a.join(' ')}" }.join("; ")
+    end
+
+    # Parse une CSP en Hash<String, Set<String>>.
+    def self.parse(csp)
+      out = {}
+      csp.to_s.split(";").each do |part|
+        name, *vals = part.strip.split(/\s+/)
+        next if name.nil? || name.empty?
+        out[name] = (out[name] || Set.new) | vals
+      end
+      out
+    end
+  end
+end

data/lib/shugoi/locales.rb

@@ -0,0 +1,39 @@
+# frozen_string_literal: true
+
+module Shugoi
+  # Messages localisés des pages de blocage — parité avec locales.ts (module Node).
+  module Locales
+    FR = {
+      rate_limit_title: "Trop de requêtes",
+      rate_limit_badge: "Rate Limit",
+      blocked_title: "Accès bloqué",
+      blocked_badge: "Blocage",
+      tamper_title: "Remplacement de contenu client détecté",
+      tamper_body: "Nous avons remarqué que vous avez tenté de modifier manuellement le rendu client côté navigateur via les DevTools. Cette pratique est évidemment bloquée par nos services.",
+      devtools_body: "L'utilisation des DevTools pour remplacer le contenu ou modifier les requêtes réseau a été détectée. L'intégrité de la page est protégée et toute altération est immédiatement bloquée.",
+      retry_in_seconds: ->(s) { "Il reste #{s}s avant de pouvoir réessayer." }
+    }.freeze
+
+    EN = {
+      rate_limit_title: "Too Many Requests",
+      rate_limit_badge: "Rate Limit",
+      blocked_title: "Access Blocked",
+      blocked_badge: "Blocked",
+      tamper_title: "Client Content Replacement Detected",
+      tamper_body: "We noticed you attempted to manually modify the client-side rendering via DevTools. This practice is obviously blocked by our services.",
+      devtools_body: "Using DevTools to replace content or modify network requests has been detected. Page integrity is protected and any alteration is immediately blocked.",
+      retry_in_seconds: ->(s) { "Retry in #{s}s." }
+    }.freeze
+
+    def self.messages(locale)
+      locale == "fr" ? FR : EN
+    end
+
+    def self.resolve_locale(explicit, accept_language)
+      return explicit.to_s if explicit
+      return "fr" if accept_language.to_s.match?(/^fr\b|,\s*fr\b/i)
+
+      "en"
+    end
+  end
+end

data/lib/shugoi/notice.rb

@@ -76,11 +76,15 @@ module Shugoi
     # @param html [String] HTML rendu
     # @param mid [String] machineId du client
     # @param site_key [String] siteKey
+    # @param base_url [String] base URL de l'API (injectée : window.__sg_baseUrl est
+    #   nettoyé par _sgCl côté client après ~1,5 s — sinon la notice appellerait /notice
+    #   relatif et l'ack ne passerait jamais)
     # @return [String] HTML avec la notice injectée
-    def self.inject(html, mid, site_key)
+    def self.inject(html, mid, site_key, base_url = "")
       script = SCRIPT
         .gsub("var mid=window.__sg_mid||'';", "var mid=#{JSON.generate(mid)}||'';")
         .gsub("var sk=window.__sg_siteKey||'';", "var sk=#{JSON.generate(site_key)}||'';")
+        .gsub("var base=window.__sg_baseUrl||'';", "var base=#{JSON.generate(base_url.to_s)}||window.__sg_baseUrl||'';")
       if html.include?("</body>")
         html.sub("</body>", "#{script}</body>")
       else

data/lib/shugoi/pow.rb

@@ -1,12 +1,16 @@
 # frozen_string_literal: true
 
 module Shugoi
-  # Proof-of-work anti-curl.
-  # Parité avec core.ts (module Node) :
+  # Proof-of-work anti-curl + cookies HMAC — parité avec core.ts (module Node) :
   #   salt = HMAC(secret, ts)
   #   proof = "ts:nonce" où SHA256(salt:nonce) a >= POW_DIFFICULTY bits à zéro en tête.
+  #   __sg_ok        : ts:HMAC(secret, "sg_ok:ts")         — 30 jours, saute le pre-flight PoW
+  #   __sg_authorized: ts:HMAC(secret, "sg_authorized:ts") — 120 s, protège les assets /assets/*
   class Pow
-    def initialize(signing_secret, difficulty = 10, ttl_ms = 120_000)
+    POW_OK_TTL_MS = 30 * 24 * 3600 * 1000
+    AUTHORIZED_TTL_MS = 120_000
+
+    def initialize(signing_secret, difficulty = 14, ttl_ms = 60_000)
       @secret = signing_secret.to_s
       @difficulty = difficulty
       @ttl_ms = ttl_ms
@@ -18,7 +22,7 @@ module Shugoi
       { ts: ts, salt: salt(ts), difficulty: @difficulty }
     end
 
-    # Vérifie un proof "ts:nonce".
+    # Vérifie un proof "ts:nonce" (fenêtre @ttl_ms, comptage de bits CORRIGÉ).
     def valid?(proof)
       return false if proof.to_s.empty? || @secret.empty?
       ts_str, solution = proof.to_s.split(":", 2)
@@ -32,10 +36,65 @@ module Shugoi
       Utils.leading_zero_bits(digest) >= @difficulty
     end
 
+    # Valeur du cookie __sg_ok (HMAC serveur, 30 j).
+    def sg_ok_value
+      ts = Utils.now_sec
+      "#{ts}:#{Utils.hmac_hex(@secret, "sg_ok:#{ts}")}"
+    end
+
+    def sg_ok_valid?(cookie_val)
+      return false if @secret.empty? || cookie_val.to_s.empty?
+      ts_str, sig = cookie_val.to_s.split(":", 2)
+      return false if ts_str.nil? || sig.nil?
+
+      ts = ts_str.to_i
+      return false if ts.zero?
+      return false if Utils.now_ms - ts * 1000 > POW_OK_TTL_MS
+      return false if ts * 1000 > Utils.now_ms + 60_000
+
+      Utils.secure_equals(sig, Utils.hmac_hex(@secret, "sg_ok:#{ts_str}"))
+    end
+
+    # String Set-Cookie pour __sg_ok (posé par le middleware après une preuve valide).
+    # @return [String, nil] nil si la preuve n'est pas valide
+    def sg_ok_cookie(proof)
+      return nil unless valid?(proof)
+      secure = production? ? "; Secure" : ""
+      "__sg_ok=#{sg_ok_value}; Path=/; HttpOnly; SameSite=Lax; Max-Age=#{POW_OK_TTL_MS / 1000}#{secure}"
+    end
+
+    # Cookie __sg_authorized posé par handleRender après un render réussi (grant valide).
+    def sg_authorized_value
+      ts = Utils.now_sec
+      "#{ts}:#{Utils.hmac_hex(@secret, "sg_authorized:#{ts}")}"
+    end
+
+    def sg_authorized_valid?(cookie_val)
+      return false if @secret.empty? || cookie_val.to_s.empty?
+      ts_str, sig = cookie_val.to_s.split(":", 2)
+      return false if ts_str.nil? || sig.nil?
+
+      ts = ts_str.to_i
+      return false if ts.zero?
+      return false if Utils.now_ms - ts * 1000 > AUTHORIZED_TTL_MS
+      return false if ts * 1000 > Utils.now_ms + 60_000
+
+      Utils.secure_equals(sig, Utils.hmac_hex(@secret, "sg_authorized:#{ts_str}"))
+    end
+
+    def sg_authorized_cookie
+      secure = production? ? "; Secure" : ""
+      "__sg_authorized=#{sg_authorized_value}; Path=/; HttpOnly; SameSite=Strict; Max-Age=120#{secure}"
+    end
+
     private
 
     def salt(ts)
       Utils.hmac_hex(@secret, ts.to_s)
     end
+
+    def production?
+      ENV["NODE_ENV"] == "production" || ENV["RACK_ENV"] == "production"
+    end
   end
 end

data/lib/shugoi/rack/middleware.rb

@@ -16,33 +16,42 @@ module Shugoi
         @app = app
         @config = Config.new(options)
         @api_client = ApiClient.new(@config.base_url, debug: @config.debug)
+        # Config (whitelist + flags + skipPaths) et render : via internalUrl pour éviter
+        # le deadlock (appels serveur→serveur qui repasseraient par le middleware public).
+        @api_internal = ApiClient.new(@config.internal_url, debug: @config.debug)
         @guard_cache = GuardCache.new(@api_client)
-        @config_cache = ConfigCache.new(@api_client)
+        @config_cache = ConfigCache.new(@api_internal)
         @token_signer = TokenSigner.new(@config.signing_secret)
         @html_store = HtmlStore.new(disk_path: options[:disk_path])
         @pow = Pow.new(@config.signing_secret, @config.pow_difficulty, @config.pow_ttl_ms)
         @skeleton = SkeletonGenerator.new(@config, @guard_cache, @config_cache, @token_signer)
-        @render = RenderHandler.new(@config, @token_signer, @html_store, @config_cache)
+        @render = RenderHandler.new(@config, @token_signer, @html_store, @config_cache, @pow)
         @core = Core.new(@config, @pow, @api_client)
+        @csp = Csp.build(site_key: @config.site_key, api_origin: Csp.origin_of(@config.base_url), extra_directives: @config.extra_directives, split_render: @config.split_render)
       end
 
       def call(env)
         path = env["PATH_INFO"].to_s
         query = parse_query(env["QUERY_STRING"].to_s)
+        method = env["REQUEST_METHOD"].to_s.upcase
 
-        # Render endpoint.
+        # Render endpoint — GET/HEAD uniquement (round 13, parité module Node).
         if path.end_with?("/__shugoi/render")
+          return method_not_allowed unless %w[GET HEAD].include?(method)
           return handle_render(env, query)
         end
 
-        # CSP.
-        headers = {}
-        headers["content-security-policy"] = csp_header if @config.csp_enabled
+        # Challenge page — GET/HEAD uniquement.
+        if path == "/__sg_challenge" && !%w[GET HEAD].include?(method)
+          return method_not_allowed
+        end
 
         ctx = build_ctx(env, query)
         decision = @core.evaluate(ctx)
 
         if decision
+          headers = {}
+          headers["content-security-policy"] = @csp if @config.csp_enabled
           h = headers.merge(decision.headers || {})
           h["content-type"] = decision.content_type
           return [decision.status, h, [decision.body]]
@@ -61,8 +70,23 @@ module Shugoi
         # Rack 3 exige des noms de headers en minuscules → on normalise.
         resp_headers = resp_headers.each_with_object({}) { |(k, v), acc| acc[k.to_s.downcase] = v }
 
+        # CSP fusionnée avec celle éventuellement posée par l'app (parité middleware.ts).
+        if @config.csp_enabled
+          existing = resp_headers["content-security-policy"]
+          resp_headers["content-security-policy"] = Csp.merge(existing, @csp)
+        end
+
+        # PoW validé → pose le cookie __sg_ok (navigations suivantes sans challenge).
+        if (proof = query["sg_proof"]) && !decision
+          if (ok_cookie = @pow.sg_ok_cookie(proof))
+            resp_headers["set-cookie"] = ok_cookie
+          end
+        end
+
+        is_bot = @core.is_trusted_bot?(ctx[:ua].to_s, ctx[:ip].to_s)
+
         # L'allowlist skip le split-render aussi (parité Node : `!core.isAllowlisted(path)`).
-        return [status, resp_headers, body] unless @config.auto_inject && @config.split_render && !@config.is_allowlisted?(path)
+        return [status, resp_headers, body] unless @config.auto_inject && @config.split_render && !is_bot && !@config.is_allowlisted?(path)
 
         html = body.respond_to?(:each) ? body.each.to_a.join : body.to_s
         ct = resp_headers["content-type"].to_s
@@ -90,6 +114,7 @@ module Shugoi
         ua = env["HTTP_USER_AGENT"].to_s
         ip = (env["HTTP_X_FORWARDED_FOR"].to_s.split(",")[0] || "").strip
         ip = env["REMOTE_ADDR"].to_s if ip.empty?
+        cookie = env["HTTP_COOKIE"].to_s
         {
           path: env["PATH_INFO"].to_s,
           ua: ua,
@@ -99,6 +124,8 @@ module Shugoi
           sec_fetch_dest: env["HTTP_SEC_FETCH_DEST"],
           sec_fetch_mode: env["HTTP_SEC_FETCH_MODE"],
           sg_proof: query["sg_proof"],
+          sg_ok: cookie.match(/(?:^|;\s*)__sg_ok=([^;]+)/) ? Regexp.last_match(1) : nil,
+          sg_authorized: cookie.match(/(?:^|;\s*)__sg_authorized=([^;]+)/) ? Regexp.last_match(1) : nil,
           forwarded_prefix: env["HTTP_X_FORWARDED_PREFIX"]
         }
       end
@@ -110,8 +137,20 @@ module Shugoi
         ip = (env["HTTP_X_FORWARDED_FOR"].to_s.split(",")[0] || "").strip
         ip = env["REMOTE_ADDR"].to_s if ip.empty?
         data = @render.render_data(token, mid, grant, ip)
+        headers = {}
+        if data[:html]
+          # Anti-fuite du grant : strict-origin-when-cross-origin (jamais le grant dans
+          # le Referer cross-origin). Contenu protégé : jamais mis en cache (round 6).
+          data[:html] = RenderHandler.inject_referrer_policy(data[:html])
+          headers["referrer-policy"] = "strict-origin-when-cross-origin"
+          headers["cache-control"] = "no-store, no-cache, must-revalidate, no-transform"
+          headers["pragma"] = "no-cache"
+          # Cookie __sg_authorized : autorise ensuite le chargement des assets protégés.
+          headers["set-cookie"] = @pow.sg_authorized_cookie
+        end
+        headers["content-type"] = "application/json"
         body = JSON.generate(data)
-        [200, { "content-type" => "application/json", "cache-control" => "no-store" }, [body]]
+        [200, headers, [body]]
       end
 
       def inject_guards(html, ctx)
@@ -139,12 +178,9 @@ module Shugoi
         @skeleton.generate(@config.site_key, signed, @config.base_url, render_url)
       end
 
-      def csp_header
-        base = "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://shugoi.com; " \
-               "connect-src 'self' https://shugoi.com; style-src 'self' 'unsafe-inline' https://shugoi.com; " \
-               "font-src 'self' https://shugoi.com data:; img-src 'self' https://shugoi.com data: blob:; " \
-               "frame-ancestors 'self'; object-src 'none'; base-uri 'self'; form-action 'self'"
-        base
+      def method_not_allowed
+        body = JSON.generate(error: "method_not_allowed")
+        [405, { "content-type" => "application/json" }, [body]]
       end
 
       def parse_query(qs)

data/lib/shugoi/rails/configuration.rb

@@ -30,8 +30,8 @@ module Shugoi
         @split_render = true
         @multi_process = false
         @verify_bots = true
-        @pow_difficulty = 10
-        @pow_ttl_ms = 120_000
+        @pow_difficulty = 14
+        @pow_ttl_ms = 60_000
       end
 
       def to_options

data/lib/shugoi/render_handler.rb

@@ -4,7 +4,7 @@ module Shugoi
   # Traite la requête /__shugoi/render : vérifie token + grant, sert le HTML stocké.
   # Parité avec renderResponseData + handleRender (render.ts).
   class RenderHandler
-    def initialize(config, token_signer, html_store, config_cache)
+    def initialize(config, token_signer, html_store, config_cache, _pow = nil)
       @config = config
       @token_signer = token_signer
       @html_store = html_store
@@ -12,7 +12,7 @@ module Shugoi
     end
 
     # @param token [String] token render
-    # @param mid [String] machineId
+    # @param mid [String] machineId (SHA-256 du fingerprint, 64 hex)
     # @param grant [String] render-grant
     # @param ip [String]
     # @return [Hash] { html: … } ou { error: "not_found" }
@@ -27,7 +27,7 @@ module Shugoi
       tok_ts = token.split(":")[1].to_i
       return { error: "not_found" } if !tok_ts.zero? && Utils.now_ms - tok_ts > HtmlStore::TOKEN_TTL_MS
 
-      # Anti-bypass token-only : grant valide requis.
+      # Anti-bypass token-only : grant valide requis (lié au siteKey + mid hex-64 + TTL 60s).
       return { error: "not_found" } unless @token_signer.verify_render_grant(mid, grant, token, ip, @config.site_key)
 
       content_replace_on = content_replace_flag?(token)
@@ -45,12 +45,27 @@ module Shugoi
       { error: "not_found" }
     end
 
+    # Anti-fuite du grant (parité injectReferrerPolicy de render.ts) : strict-origin-when-
+    # cross-origin (PAS no-referrer — casserait les embeds YouTube 153). Injecté dans le
+    # HTML rendu AVANT document.write, le grant n'est plus dans l'URL de la page.
+    def self.inject_referrer_policy(html)
+      meta = '<meta name="referrer" content="strict-origin-when-cross-origin">'
+      if html.include?("<head>")
+        html.sub("<head>", "<head>#{meta}")
+      elsif (m = html.match(/<html[^>]*>/))
+        html.sub(m[0], "#{m[0]}#{meta}")
+      else
+        "#{meta}#{html}"
+      end
+    end
+
     private
 
-    # Injecte la notice de consentement (parité handleRender : `if (data.html && mid)`).
+    # Injecte la notice de consentement (parité handleRender : `if (data.html && mid)`),
+    # avec la base URL injectée (window.__sg_baseUrl est nettoyé par _sgCl côté client).
     def inject_notice(html, mid)
       return html if mid.to_s.empty?
-      Notice.inject(html, mid, @config.site_key)
+      Notice.inject(html, mid, @config.site_key, @config.base_url)
     end
 
     def content_replace_flag?(token)

data/lib/shugoi/skeleton_generator.rb

@@ -12,16 +12,21 @@ module Shugoi
     end
 
     # @return [String] HTML du skeleton (<script>…eval([...])…</script>)
-    def generate(site_key, token, base_url, render_url = "./__shugoi/render", locale = "en")
+    def generate(site_key, token, base_url, render_url = "./__shugoi/render", locale = nil)
+      locale ||= Locales.resolve_locale(@config.locale, nil)
       @guard_cache.ensure_ready(site_key, @config.signing_secret)
       cfg_data = @config_cache.fetch(site_key)
       flags = cfg_data[:flags]
       detect = @guard_cache.detect
+      msgs = Locales.messages(locale)
 
       fragments = []
       fragments << "window.__sg_siteKey=#{json(site_key)}"
       fragments << "window.__sg_baseUrl=#{json(base_url)}"
       fragments << "window.__sg_config=#{json(flags)}"
+      # Mode debug (audit #8) : piloté UNIQUEMENT par le serveur. En production ce flag
+      # est toujours false → le guard n'active jamais ses traces via ?sg_probe_debug=1.
+      fragments << "window.__sg_diagEnabled=#{production? ? 'false' : 'true'}"
       fragments << "try{if((location.search||'').indexOf('sg_proof=')>=0){var _qs=location.search.replace(/[?&]sg_proof=[^&]*/,'');var _cu=location.pathname+(_qs?_qs:'')+location.hash;history.replaceState(null,'',_cu)}}catch(e){}"
 
       pow = Pow.new(@config.signing_secret, @config.pow_difficulty, @config.pow_ttl_ms).challenge
@@ -33,8 +38,8 @@ module Shugoi
       fragments << "window.__sg_disableRestrictedAccess=true" unless @config.restricted_access
       fragments << "try{#{detect}}catch(e){window.__sg_blocked=true}" if detect
 
-      # __sg_showBlock (page de blocage néobrutaliste)
-      fragments << show_block_fragment
+      # __sg_showBlock (page de blocage néobrutaliste) — messages localisés interpolés.
+      fragments << show_block_fragment(msgs)
 
       fragments << "var t=\"#{token}\""
       fragments << "window.__sg_token=\"#{token}\""
@@ -43,21 +48,18 @@ module Shugoi
       fragments << "var r=\"#{render_url}\""
 
       # rd(p,n) : remplacement du document par le contenu rendu.
-      fragments << rd_fragment
+      fragments << rd_fragment(msgs)
 
       fragments << "_gw(function(){rd(r+\"?token=\"+t,0);setTimeout(_sgCl,1500)})"
       fragments << cleanup_fragment
 
       combined = fragments.join(";")
       # Échappe `</script>` et `</style>` AVANT l'encodage unicode : sans ça, le HTML parser
-      # du navigateur coupe le <script> dès qu'il rencontre `</script>` dans le bootcode
-      # (ex. le guard-detect obfusqué contient des balises) → SyntaxError: Unexpected token '<'.
-      # Parité avec escapeClosingTags (module Node).
+      # du navigateur coupe le <script> dès qu'il rencontre `</script>` dans le bootcode.
       combined = combined.gsub(%r{</(script|style)}i, "<\\/$1")
       enc = Utils.unicode_encode(combined)
       decoded_call = "[...'#{enc}'].map(x=>String.fromCodePoint(x.codePointAt(0)-917504)).join('')"
-      # <meta charset=UTF-8> : garantit que le navigateur lit le bootcode unicode en UTF-8
-      # (sans ça, interprété en Latin-1 → RangeError au décodage).
+      # <meta charset=UTF-8> : garantit que le navigateur lit le bootcode unicode en UTF-8.
       "<meta charset=\"UTF-8\"><script>eval(#{decoded_call})</script>"
     end
 
@@ -67,22 +69,35 @@ module Shugoi
       JSON.generate(obj)
     end
 
-    def show_block_fragment
-      css = "body{font-family:system-ui,-apple-system,'Segoe UI',Roboto,sans-serif;display:flex;align-items:center;justify-content:center;padding:1.2rem}#c{max-width:460px;width:100%;background:#fff;border:4px solid #000;border-radius:28px 6px 32px 10px;box-shadow:12px 12px 0 #000;padding:3rem 2.4rem 2.8rem;text-align:center}#c .bdg{display:inline-block;border:2px solid #000;border-radius:10px 2px 14px 4px;padding:.3rem .9rem;font-size:.6rem;font-weight:700;text-transform:uppercase;letter-spacing:.1em;color:#E87090;margin-bottom:1.4rem}#c h2{font-family:'Alex Brush',Georgia,'Times New Roman',serif;font-size:2.2rem;color:#E87090;font-weight:400;margin:0 auto .6rem}#c p.desc{font-size:.9rem;color:#555;line-height:1.8;max-width:380px;margin:0 auto}#c p.ft{font-size:.55rem;color:#E87090;margin-top:1.8rem}"
-      "window.__sg_showBlock=function(msg,title,badge){var h=\"<head><meta charset=UTF-8><meta name=viewport content=width=device-width,initial-scale=1><style>#{css}</style></head><body><div id=c><img src=https://shugoi.com/favicon-block.png class=l><img src=https://shugoi.com/brand-block.png class=b><div class=bdg>\"+(badge||\"\")+\"</div><h2>\"+(title||\"\")+\"</h2><p class=desc>\"+(msg||\"\")+\"</p><p class=ft>\"+location.hostname+\" \\u00b7 Shugoi</p></div></body>\";document.documentElement.innerHTML=h}"
+    def production?
+      ENV["NODE_ENV"] == "production" || ENV["RACK_ENV"] == "production" || ENV["RAILS_ENV"] == "production"
     end
 
-    def rd_fragment
+    # jsStr : chaîne JSON sans les guillemets externes + échappe `<` (parité render.ts).
+    def js_str(s)
+      JSON.generate(s.to_s).slice(1..-2).gsub("<", "\\x3c")
+    end
+
+    def show_block_fragment(msgs)
+      fb_badge = js_str(msgs[:blocked_badge])
+      fb_title = js_str(msgs[:blocked_title])
+      css = "html,body{height:100%;background:#fcf9f5}body{font-family:system-ui,-apple-system,'Segoe UI',Roboto,sans-serif;display:flex;align-items:center;justify-content:center;padding:1.2rem}#c{max-width:460px;width:100%;background:#fff;border:4px solid #000;border-radius:28px 6px 32px 10px;box-shadow:12px 12px 0 #000;padding:3rem 2.4rem 2.8rem;text-align:center}#c .bdg{display:inline-block;border:2px solid #000;border-radius:10px 2px 14px 4px;padding:.3rem .9rem;font-size:.6rem;font-weight:700;text-transform:uppercase;letter-spacing:.1em;color:#E87090;margin-bottom:1.4rem}#c h2{font-family:'Alex Brush',Georgia,'Times New Roman',serif;font-size:2.2rem;color:#E87090;font-weight:400;margin:0 auto .6rem}#c p.desc{font-size:.9rem;color:#555;line-height:1.8;max-width:380px;margin:0 auto}#c p.ft{font-size:.55rem;color:#E87090;margin-top:1.8rem}"
+      "window.__sg_showBlock=function(msg,title,badge){var h=\"<head><meta charset=UTF-8><meta name=viewport content=width=device-width,initial-scale=1><style>@font-face{font-family:\\x27Alex Brush\\x27;src:url(https://shugoi.com/alex-brush.woff2?v=2) format(\\x27woff2\\x27);font-display:swap}*,*::before,*::after{box-sizing:border-box;margin:0;padding:0}#{css}</style></head><body><div id=c><img src=https://shugoi.com/favicon-block.png class=l><img src=https://shugoi.com/brand-block.png class=b><div class=bdg>\"+(badge||\"#{fb_badge}\")+\"</div><h2>\"+(title||\"#{fb_title}\")+\"</h2><p class=desc>\"+(msg||\"\")+\"</p><p class=ft>\"+location.hostname+\" \\u00b7 Shugoi</p></div></body>\";document.documentElement.innerHTML=h}"
+    end
+
+    def rd_fragment(msgs)
+      devtools = js_str(msgs[:devtools_body])
+      tamper_title = js_str(msgs[:tamper_title])
       "var _gw=function(cb){if(window.__sg_guardsReady||window.__sg_blocked)cb();else setTimeout(function(){_gw(cb)},100)};" \
         "function rd(p,n){if(window.__sg_blocked)return;if(!document.body)return setTimeout(function(){rd(p,n)},50);" \
-        "if(n>6){if((window.__sg_config||{}).enableContentReplacementCheck===true)window.__sg_showBlock&&window.__sg_showBlock(\"\",\"\",\"\");return}" \
+        "if(n>6){if((window.__sg_config||{}).enableContentReplacementCheck===true)window.__sg_showBlock&&window.__sg_showBlock(\"#{devtools}\",\"#{tamper_title}\");return}" \
         "var _g=(window.__sg_grant||\"\");if(_g){p=p+(\"&grant=\"+encodeURIComponent(_g))}" \
         "var _m=(window.__sg_detectMid||window.__sg_mid||\"\");if(_m){p=p+(\"&mid=\"+encodeURIComponent(_m))}" \
         "fetch(p).then(function(x){return x.json()}).then(function(d){if(window.__sg_blocked)return;" \
         "if(!document.body)return setTimeout(function(){rd(p,n+1)},50);" \
         "if(d.html){document.open(\"text/html\");document.write(d.html);document.close();window.scrollTo(0,0)}" \
         "if(d.blocked){window.__sg_showBlock&&window.__sg_showBlock(d.message,d.title)}" \
-        "if(d.error){if((window.__sg_config||{}).enableContentReplacementCheck===true)window.__sg_showBlock&&window.__sg_showBlock(\"\",\"\",\"\")}" \
+        "if(d.error){if((window.__sg_config||{}).enableContentReplacementCheck===true)window.__sg_showBlock&&window.__sg_showBlock(\"#{devtools}\",\"#{tamper_title}\")}" \
         "else if(!d.html&&!d.blocked){setTimeout(function(){rd(p,n+1)},300)}})" \
         ".catch(function(){setTimeout(function(){rd(p,n+1)},300)})}"
     end

data/lib/shugoi/token_signer.rb

@@ -6,7 +6,8 @@ module Shugoi
   #   token :  siteKey:timestamp:nonce:sig        (sig = HMAC(secret, "siteKey:ts:nonce"))
   #   grant :  base36(ts):HMAC(secret, "render-grant:siteKey:mid:token:ip:ts")
   class TokenSigner
-    GRANT_TTL_MS = 120_000
+    # Parité module Node (render.ts) : TTL du render-grant réduit à 60 s (audit 2026-08-03).
+    GRANT_TTL_MS = 60_000
 
     def initialize(secret)
       @secret = secret.to_s

data/lib/shugoi/utils.rb

@@ -39,7 +39,11 @@ module Shugoi
       str.to_s.to_i(36)
     end
 
-    # Nombre de bits à zéro en tête du digest hex (parité avec la fonction JS `bits`).
+    # Nombre de bits à zéro en tête du digest hex (parité avec la fonction JS `bits`
+    # du module Node). Audit 2026-08-03 : comptage CORRIGÉ — l'ancienne version
+    # (nib.to_s(2).match(/^0*/)[0].length) sous-comptait les zéros internes du premier
+    # nibble non-nul (`3` → '11' → 0 au lieu de 2). Le comptage ci-dessous est exact et
+    # DOIT rester synchrone avec core.rb (isPowValid), le challenge JS et le guard.
     def leading_zero_bits(hex_digest)
       leading = 0
       hex_digest.each_char do |c|
@@ -48,7 +52,7 @@ module Shugoi
           leading += 4
           next
         end
-        leading += nib.to_s(2).match(/^0*/)[0].length
+        leading += (nib & 8) != 0 ? 0 : (nib & 4) != 0 ? 1 : (nib & 2) != 0 ? 2 : 3
         break
       end
       leading
@@ -81,5 +85,15 @@ module Shugoi
     def escape_json_string(s)
       JSON.generate(s.to_s)[1..-2]
     end
+
+    # Échappement HTML (parité escapeHtml de core.ts).
+    def escape_html(s)
+      s.to_s
+        .gsub("&", "&")
+        .gsub("<", "&lt;")
+        .gsub(">", "&gt;")
+        .gsub('"', "&quot;")
+        .gsub("'", "&#39;")
+    end
   end
 end

data/lib/shugoi/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Shugoi
-  VERSION = "0.2.0"
+  VERSION = "0.3.0"
 end

data/lib/shugoi.rb

@@ -3,10 +3,13 @@
 require_relative "shugoi/version"
 require_relative "shugoi/errors"
 require_relative "shugoi/constants"
+require_relative "shugoi/locales"
+require_relative "shugoi/csp"
 require_relative "shugoi/config"
 require_relative "shugoi/utils"
 require_relative "shugoi/token_signer"
 require_relative "shugoi/pow"
+require_relative "shugoi/bot_verifier"
 require_relative "shugoi/api_client"
 require_relative "shugoi/guard_cache"
 require_relative "shugoi/config_cache"

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: shugoi
 version: !ruby/object:Gem::Version
-  version: 0.2.0
+  version: 0.3.0
 platform: ruby
 authors:
 - Shugoi
@@ -62,13 +62,16 @@ files:
 - README.md
 - lib/shugoi.rb
 - lib/shugoi/api_client.rb
+- lib/shugoi/bot_verifier.rb
 - lib/shugoi/config.rb
 - lib/shugoi/config_cache.rb
 - lib/shugoi/constants.rb
 - lib/shugoi/core.rb
+- lib/shugoi/csp.rb
 - lib/shugoi/errors.rb
 - lib/shugoi/guard_cache.rb
 - lib/shugoi/html_store.rb
+- lib/shugoi/locales.rb
 - lib/shugoi/notice.rb
 - lib/shugoi/pow.rb
 - lib/shugoi/rack/middleware.rb